fix: migrate npm publish to blacksmith trusted auth (no classic tokens)

Classic npm automation tokens were revoked in March 2025. Switch to
useblacksmith/setup-node@v5 which handles auth via the runner
environment. Also upgrade actions/checkout to v4 and disable provenance
(required for self-hosted runners).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jbiskur

.github/workflows/build.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2204
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           token: ${{ secrets.FLOWCORE_MACHINE_GITHUB_TOKEN }}
           submodules: true
@@ -37,10 +37,11 @@ jobs:
         run: deno publish
       - name: Build for NPM
         run: deno run -A bin/build-npm.ts
-      - uses: actions/setup-node@v4
+      - uses: useblacksmith/setup-node@v5
         with:
           node-version: "20.x"
           registry-url: "https://registry.npmjs.org"
-      - run: ( cd npm && npm publish --access public )
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - name: Update npm
+        run: npm install -g npm@latest
+      - name: Publish to NPM
+        run: ( cd npm && npm publish --access public --provenance=false )

.github/workflows/validate.yml

@@ -36,7 +36,7 @@ jobs:
           --health-retries 5
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           token: ${{ secrets.FLOWCORE_MACHINE_GITHUB_TOKEN }}
           submodules: true